PaperCut Attacks Target Education Sector

The education sector is in the crosshairs of a targeted credential theft campaign that takes advantage of two recently patched PaperCut vulnerabilities. Reports from the Arctic Wolf Adversary Research Team indicate that attackers have been chaining a pair of flaws, tracked as an authentication bypass and remote code execution issue, to break into vulnerable PaperCut servers. The activity, which has hit organizations from K-12 schools to major universities across the U.S. and Europe, appears aimed at harvesting credentials and other sensitive data.

Active Exploitation in the Wild

Arctic Wolf says it has observed attackers actively exploiting CVE-2026-81578 and CVE-2026-82078. The two flaws, when combined, allow an attacker to bypass authentication and achieve remote code execution. The company reported finding post-exploitation activity that includes command execution, reconnaissance, and the creation of privileged accounts.

“Observed post-exploitation activity included delivery of Windows registry hive collection tools, Metasploit/Meterpreter-related Java payloads, and commands used to identify hosts, users, processes, and sensitive configuration data,” Arctic Wolf said in a statement. The cybersecurity firm also shared details of the malicious activity with The Hacker News, noting the attacks have targeted the education sector specifically.

Post-Exploitation Playbook

The attackers follow a distinct pattern of behavior once they gain access. Among the identified activities are running a series of discovery commands such as uname, whoami, ver, and tasklist, which help them map out the compromised system. They also create privileged accounts, including one dubbed Administrator17.

The threat actors also make inbound GET requests from the IP address 45.142.193[.]132 looking for files named /custom/pcp_*.txt and /custom/web/pcp_*.txt. These files are used to store harvested system and user data, which is then exfiltrated from the compromised hosts.

Credential Harvesting and Data Collection

The attackers deliver a set of credential-harvesting tools, including lsa_collect.exe, lsa_collect_small.exe, and save_hives.exe, using certutil.exe as the download mechanism. In one instance, Arctic Wolf said it detected “lsa_collect.exe” in a sandbox that extracted specific registry keys to reconstruct the system BootKey, a step that can grant the attacker access to the SAM database.

The attackers also use findstr to search PaperCut configuration files for keywords like “password,” “secret,” “ldap,” “bind,” and “token”. This allows them to pull out plaintext credentials or tokens that could be used to move laterally or access other systems.

• CVE-2026-81578 and CVE-2026-82078 are being actively exploited as an authentication bypass and remote code execution chain.
• Attackers have targeted organizations ranging from K-12 schools to major universities in the U.S. and Europe.
• Malicious activity includes command execution, reconnaissance, privileged account creation, and delivery of registry hive collection tools.

Stolen Logins as a Gateway

The ultimate goal appears to be credential theft. In a statement, Arctic Wolf noted the potential impact of these stolen logins. “The concern is that those stolen logins could give attackers a pathway into other critical systems across the environment,” the company said.

The harvesting of local credentials from the SAM database, combined with searches for configuration file secrets, provides attackers with a broad set of credentials that could be used to access email, cloud services, or other internal applications.

Mitigation and Monitoring Advice

Given the active exploitation, Arctic Wolf is urging organizations that run PaperCut servers to take immediate action. The company recommends restricting PaperCut servers from being exposed to the internet. In addition, administrators should monitor for the execution of cmd.exe, powershell.exe, or other scripting and command interpreters, as well as for commands containing whoami, tasklist, ver, or uname -a with pc-app.exe as the parent process.

Implications for Reading This

This campaign highlights a growing risk for educational institutions that rely on print management software like PaperCut. Since many schools and universities run such servers on-premises, a single compromised server could give attackers access to a network segment with substantial sensitive data.

While PaperCut has patched the flaws, the reality of this campaign suggests that many servers remain unpatched or are still exposed to the internet. Organizations should inventory their PaperCut installations, apply the latest updates, and verify that no unauthorized accounts have been created. For IT teams, the key takeaway is that credential theft can be a stepping stone to broader network compromise, and monitoring for the specific indicators of compromise listed above could help catch an attack early.